Initial commit - 611 cybersecurity skills across all subdomains

skills/performing-false-positive-reduction-in-siem/references/standards.md

@@ -0,0 +1,28 @@
+# Standards - False Positive Reduction in SIEM
+
+## Detection Quality Metrics (Industry Standards)
+
+| Metric | Excellent | Good | Needs Improvement | Critical |
+|---|---|---|---|---|
+| False Positive Rate | < 10% | 10-20% | 20-40% | > 40% |
+| Rule Precision | > 0.90 | 0.80-0.90 | 0.60-0.80 | < 0.60 |
+| Mean Triage Time | < 5 min | 5-10 min | 10-20 min | > 20 min |
+| Alert-to-Incident Ratio | 1:5 | 1:10 | 1:20 | > 1:50 |
+
+## Tuning Frameworks
+
+### NIST Continuous Monitoring (SP 800-137)
+- Requires regular assessment and adjustment of detection capabilities
+- Defines metrics-based approach to monitoring effectiveness
+
+### SANS Detection Maturity Model
+- Level 1: Basic alerts with high FP rate
+- Level 2: Tuned alerts with correlation
+- Level 3: Behavioral analytics reducing noise
+- Level 4: Automated tuning with ML feedback loops
+
+## Allowlist Management Standards
+- All exclusions require documented justification
+- Expiry dates mandatory (90-day maximum default)
+- Quarterly review of all active exclusions
+- Approval from detection engineering lead required

skills/performing-false-positive-reduction-in-siem/references/workflows.md

@@ -0,0 +1,16 @@
+# Workflows - False Positive Reduction
+
+## Tuning Cycle
+```
+Identify Noisy Rules --> Analyze FP Root Causes --> Tune Rules -->
+Validate with Testing --> Measure Improvement --> Report --> Repeat
+```
+
+## FP Analysis Categorization
+| Category | Action | Example |
+|---|---|---|
+| Known benign | Add to allowlist | Vulnerability scanner IPs |
+| Threshold too low | Raise threshold | Login failure count from 5 to 20 |
+| Missing context | Add correlation | PowerShell + network = suspicious |
+| Missing enrichment | Add lookup | Asset criticality context |
+| Rule outdated | Rewrite or retire | Legacy detection no longer relevant |